My take on the needrestart Python CVE-2024-48990This simple shell script should create all the required file for this vulnerability to work.
First it creates a randomly generated temporary file that will be used to compile the fake \_\_init\_\_.so file
When the vulnerability is triggered. This file will execute and copy the bash binary to /tmp/ribbit and set the SUID bit.
Next It creates the importlib directory in the current working directory
It then compiles the temporary file created into \_\_init\_\_.so and puts it into the newly created directory
Lastly it creates another randomly named temporary python file that sleeps and waits for the vulnerability to trigger. Once triggered it will execute the SUID set bash binary resulting in a root shell.
Once the python script is started. needrestart needs to execute with root permissions. This is typically done when apt-get is used.
[4.0K] /data/pocs/8f26c792573718b08e95557929e4c1ae7f406a03
├── [1.6K] privesc.sh
└── [ 846] README.md
0 directories, 2 files